Slashdot Mirror
Researchers Discover SplitSpectre, a New Spectre-like CPU Attack (zdnet.com)
An anonymous reader writes from a report via ZDNet: Three academics from Northeastern University and three researchers from IBM Research have discovered a new variation of the Spectre CPU vulnerability that can be exploited via browser-based code. The vulnerability, which researchers codenamed SplitSpectre, is a variation of the original Spectre v1 vulnerability discovered last year and which became public in January 2018. The difference in SplitSpectre is not in what parts of a CPU's microarchitecture the flaw targets, but how the attack is carried out. Researchers say a SplitSpectre attack is both faster and easier to execute, improving an attacker's ability to recover code from targeted CPUs. The research team says they were successfully able to carry out a SplitSpectre attack against Intel Haswell and Skylake CPUs, and AMD Ryzen processors, via SpiderMonkey 52.7.4, Firefox's JavaScript engine. The good news is that existing Spectre mitigations would thwart the SplitSpectre attacks.
I presume that since mitigation measures for Spectre also work against Split Spectre, that CPUs (like mine) which aren't vulnerable to Spectre are also not vulnerable to Split Spectre?
I realize that it's a bit of speculation but it seems like a reasonable conclusion.
I know it might surprise some people but not all recent processors are vulnerable. For example, according to intel, in their i7 lineup only their 45nm and 32nm process chips are vulnerable.
time to dig out my old kim-1 and forth env.
You really need a hobby my friend. Ever thought of putting your dick in a woman?
Has manaforts lawyer released his nightly raving statement of innocence yet?
Itâ(TM)s probably a Russian bot...
Donâ(TM)t give it too hard a time, if it fails to sow enough strife Putin will have it murdered.
Oh you, managed languages are safe.
Okay so they aren't, but sandboxes are safe.
Okay alright there are bugs, but virtual machines are safe.
So about thos' virtual machines...
Yeah fuck you, throw another layer on, what does it matter.
GO HOME IVAN YOU'RE DRUNK -- In soviet America, we can still use apostrophes correctly even if Trumptards can't hit the keys correctly with their swine hooves, lol pity the dumb traitors in Red Methmerica.
linux has microcode updates as well!
GO HOME HUCKLEBERRY -- In little America we know that it's a parsing error, only dumblefucks don't know that by now.
+1
Iphones don't work in Russia? Aww.
Funny thing is, by Hitler's standards you are not aryan and, therefore, your beloved fairy tale has a surprise for you... run!
Love the great good man.
Keep dreaming!
Not really news anymore, these were predicted to come about after the initial release of proof of concepts. We can all hope that patches and firmware stops them. Or you can disable hyperthreading and pay even more of a performance hit like Open BSD has done with its OS.
Also clearly a retard, Hitler liked to have 'experiments' done on them.
Most of today's neo-nazis would have been shipped off to the camps under Hitler as 'unfit to live'.
Maybe its time to re-think not enabling the mitigations in the Linux by default?
This looking more exploitable in the wild all the time
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
The bigger and unspoken problem with these vulnerabilities and breaches that we've been seeing lately is that they all create significant penalties for the consumers along with a sense of being unable to do anything about them. People feel that the problems that can be fixed do so at the cost of time, and effort to patch, along with a near 50% reduction in power. Basically rendering their expensive computers impotent and useless paper weights. They also suffer a sense of hopelessness as there is little or nothing that they can do about it.
This all creates vulnerability fatigue, and worse still, indifference. Perhaps, even willful ignorance. People are increasingly saying; 'I'm tired of all this shit. I just want my stuff to work. I'm not going to worry about this shit anymore.'
So, rather than security being improved by researchers discoveries and the endless flood of "patches" and inconveniences. People are just closing their eyes and charging on ahead. 'Screw these esoteric vulnerabilities. Screw breaches. It happens. So what. The world doesn't end. Move on.'
People are sick and tired of hearing about risks, the inconveniences that they must endure, the scare mongering, and the ultimate futility of anything they do or think.
Frankly, I don't blame them.
Don't know how to use an apostrophe? Then you probably shouldn't post.
CamelToe would have been better.
News at 11:00.
Seriously - so they found another way to abuse spectre that still doesn't work with existing mitigation - what is exactly the important news here?
If you knew how to use a computer, you wouldn't be using character codes that don't get interpreted. Go back to school, little boy.
No just niggers, beaners and wogs would die and the world would become a better place without those shitskins.
I love killing shitskins. So far I have shot four of them for trespassing on my land. Three in the back while they tried to flee like the cowards that they are and one in the face when he was peering through my window.
This is just a timely reminder to keep JavaScript disabled in your browsers as widely as possible. Block those advertisements!
These days I use umatrix to disallow scripts on all pages on first visits. Then I'll re-enable JS case-by-case until I get the functionality I need or until I notice that the web site in question wants me to sign away my soul to 3rd parties before becoming useful at all.
All unnecessary (advertisement related) JS processes present an attack surface.
See subject:This attack's javascript based so a malicious script src can be blocked via hosts files & voila: NO problem.
APK
P.S.=> For the best hosts file for protection vs. threats + more speed/reliability/anonymity onilne:
APK Hosts File Engine 2.0++ 64-bit for Linux h t t p : / / a p k . i t - m a t e . c o . u k / A P K H o s t s F i l e E n g i n e F o r L i n u x . z i p (remove spaces between download URL characters & download)
APK Hosts File Engine 10++ SR-1 32/64-bit for Windows https://hosts-file.net/?s=Down... (see download link @ bottom of page) ... apk